github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/linux/test/landlock_layers (about)

     1  # Creates a file hierarchy.
     2  
     3  mkdirat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1c0)
     4  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0x1c0)
     5  
     6  # Creates a first ruleset to restrict file creation.
     7  
     8  r0 = landlock_create_ruleset(&AUTO={0x100, 0x0}, AUTO, 0x0)
     9  r1 = openat$dir(0xffffffffffffff9c, &AUTO='./file0\x00', 0x200000, 0x0)
    10  landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, AUTO, &AUTO={0x100, r1}, 0x0)
    11  
    12  # No need to close FDs for this test.
    13  
    14  # Enforces the first ruleset.
    15  
    16  prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)
    17  landlock_restrict_self(r0, 0x0)
    18  
    19  # Creates and remove a file: allowed by the first ruleset.
    20  
    21  mknodat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x81c0, 0x0)
    22  unlinkat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x0)
    23  
    24  # Tries to create a file: denied by the first ruleset.
    25  
    26  mknodat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x81c0, 0x0) # EACCES
    27  
    28  # Creates a second ruleset to restrict file removal.
    29  
    30  r2 = landlock_create_ruleset(&AUTO={0x20, 0x0}, AUTO, 0x0)
    31  r3 = openat$dir(0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0x200000, 0x0)
    32  landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, AUTO, &AUTO={0x20, r3}, 0x0)
    33  
    34  # Enforces the second ruleset.
    35  
    36  landlock_restrict_self(r2, 0x0)
    37  
    38  # Creates and remove files: allowed by both rulesets.
    39  
    40  mknodat(0xffffffffffffff9c, &AUTO='./file0/file0/file0\x00', 0x81c0, 0x0)
    41  unlinkat(0xffffffffffffff9c, &AUTO='./file0/file0/file0\x00', 0x0)
    42  
    43  # Creates a file: allowed by the first ruleset.
    44  
    45  mknodat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x81c0, 0x0)
    46  
    47  # Tries to remove a file: denied by the second ruleset.
    48  
    49  unlinkat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x0) # EACCES